By Sylvain Maret / Datelec Networks SA
March 2000
Welcome to Introduction
to Firewall Essentials
This course is intended to provide you with an
understanding of key concepts and theories
associated with firewalls, security policies and
attacks directed toward your network.
Course Objectives
Understand firewall basics, including the
definition of a firewall, firewall functions and the
need for firewalls
Understand firewall technologies, including
TCP/IP basics, routers and application-level
gateways (proxies)
Course Objectives (cont.)
Understand security hazards
Understand cryptography, including the need for
encryption and virtual private networks (VPNs)
Course Map
Firewall Essentials
Unit I
Chapter 1: What is a Firewall?
Chapter 2: Types of Firewalls
Chapter 3: How Firewalls Work
Course Map
Firewall Essentials
Unit II
Chapter 1: The Need for a Firewall
Chapter 2: Security Hazards
Course Map
Firewall Essentials
Unit III
Chapter 1: Firewall Features
Chapter 2: Security Policies
Open Discussion
Unit I - Chapter 1
What is a Firewall?
Securing a Network
Firewall Visiting Packets
Firewall Location
Placed at the entrance to an organizations
intranet
Placed inside an internal network
Placed between RAS and internal network
It is the check point for communication to an
outside network
Firewall Location
Corporate Data Center
Firewall Router
Firewall Firewall
Company intranet Internet
Restricted Network
Communicating Across a
Network
Network packet (level 3)
Network session (level 7)
Network Packet
Contains all the information required to route it
to the final destination
Contains the information to deliver it to the
correct application on the destination system
Requires five specific pieces of information for
routing
Comparing IP Packet
with a Letter Address
IP Packet U. S. Mail Address
Components Components Comments
Destination IP address Street address and zip code Each host on an IP Internet
or intranet must have a
unique IP address
Protocol Organization name The standard protocols
above IP are TCP and UDP
Destination port number Recipient name Identifies the network
application to receive the
packet
Source IP address Senders return address So the application knows
where to send replies
Source port number Senders name To identify the application
of the sending host for
return packets
Division of IP Address
Network - similar to a zip code, the primary
information used by routers to deliver the packet
to the correct LAN
Host - similar to a letter address, directs the
packet to the correct host on the LAN
204.32.38.105
204.32.38.104
LAN
204.32.38.103 204.32.38.102
To: 204.32.38.102
192.38.1.2 192.38.1.3 192.38.1.4
LAN
192.38.1.1
Mailing a Letter
Network Session
The total data sent between an initial request
and the completion of that request
Evident at the user or application level of the
protocol stack
Standard Firewall Services
Access Control
Authentication
Activity Logging
Other Firewall Services
Access Control
Allows the firewall to consider the network
interface where the packet enters
Prevents or limits IP spoofing
Dont talk to me unless I talk to you first
Authentication
Standards have usually relied on passwords or
smartcards or token
No based on IP address but user level
Activity Logging
Allows the firewall to record information
concerning all successful and failed session
attempts
Referred to as an audit log
Other Firewall Services
Proxy Applications
Virus Scanning
Address Mapping
Virtual Private Networks (VPN)
Firewall Administration
Interfaces
Three classes of firewall administrator
interfaces:
Text-file based administration
Text-menu based administration
GUI-based administration
Text-File Based
Administration
Popular in routers and homegrown firewalls
Interface of choice for UNIX administrators
Easier to make errors
Text-Menu Based
Administration
Reduces likelihood of errors
Less flexibility of control
Limited visual feedback to changes made
GUI-Based Administration
Most prominent
Easier to use
Less prone to errors
Actual Security Provided
A firewall can reduce the vulnerabilities on a
network, not eliminate them
Firewalls act as filters
Unit I - Chapter 2
Types of Firewalls
Three Basic Types of
Firewalls
Packet Filter
Application-Level Gateway
Stateful Inspection
Packet Filter Firewall
Referred to as filtering routers with a set of
simple rules
Determines whether a packet should pass
based on the source and destination information
within the packet
Process is performed at the kernel level
Packet Filter Firewall
(cont.)
Less secure than application-level gateway
firewalls
Packet Filtering Firewall
Packet Filter
Application
Level
Network 1 Kernel Level Network 3
Packets PASS
Filter Route
DROP
Network 2
Application-level Gateway
Firewall
Does not allow packets to pass directly between
networks
Original connections are made to a proxy on the
firewall
Application-level Gateway
Firewall (cont.)
Requires a separate application for each
network service
TELNET
FTP
E-mail
WWW
Application-level
Gateway Firewall
Application-Level Gateway
Application
Level
Network 1 Proxy Proxy Network 3
Packets
Route
Kernel Level
Network 2
Stateful Packet Filtering
Ensures the highest level of firewall security by
performing the following functions:
Accessing, analyzing and utilizing communication
information
Communication-derived state
Application-derived state
Information Manipulation
Stateful Inspection
Communication information
Information from all seven layers of the packet
Stateful Inspection
Communication-derived state
State information derived from previous
communications
Stateful Inspection
Application-derived state
State information derived from other applications
Stateful Inspection
Information manipulation
Evaluation of flexible expressions based on the
following:
communication information
communication-derived state
application-derived state
Check Points FireWall-1
Stateful Inspection
Application
Application Presentation Application
Presentation Session Presentation
Session Transport Session
Transport Network Transport
Network Network
DataLink DataLink
DataLink
Physical Physical
Physical
Inspect Engine
Dynamic
State Tables
Comparison of Firewall
Architecture
Firewall Packet Filters Application Stateful Inspection
Capability Level Gateways
Communication Partial Partial Yes
information
Communication- No Partial Yes
derived state
Application- No Yes Yes
derived state
Information Partial Yes Yes
manipulation
Unit I - Chapter 3
How Firewalls Work
How Firewalls Work:
Objectives
Identify the packet processing locations on a
firewall
Describe packet filtering and its limitations
Describe proxy applications and their limitations
Identify user authentication
Describe firewall auditing
Packet Processing
Locations
Application Level
Proxy services
Kernel Level
Routers and host-based packet filters
Network Interface Card (NIC) Level
Packet Processing Locations
Within a Firewall
Application
Proxy
Possible Firewall
Processing Locations - Kernel
Network Cards
Application Level
Kernel Level
Network Card Level
Packet Filtering
May occur at any one of the processing
locations
Most often supported at the NIC or kernel level
Passes or drops packet based on source and
destination IP addressing
Fields of Interest for
Packet Filtering
Field Purpose
Source IP address Host address of sender
Destination IP address Host address of service provider
Upper level protocol Different protocols offer different services
TCP source port number A random number greater than 1024
TCP destination port number Indicates service such as Telnet or HTTP
HTTP Filtering
Pass
X
Router
X
HTTP Packet +
X
FTP Packet
Drop X
Example Rule List
Rule Source Destination Protocol Source Action
Number Address Address Port
Number
1 10.56.2.99 * * * Drop
2 10.56.* 10.122.* TCP * Pass
3 10.122.* 10.56.* TCP 23 Pass
4 * 10.56.* TCP * Pass
5 * * * * Drop
Example Packets and
Resulting Actions
Source Destination Protocol Source Destination Match Action
Address Address Port Port Rule # Taken
Number Number
10.56.2.98 10.122.6.11 TCP 23567 23 (Telnet) 2 Pass
10.56.2.99 10.122.6.11 TCP 6723 23 (Telnet) 1 Drop
10.56.2.98 10.122.6.11 other 23568 23 (Telnet) 5 Drop
10.122.34.9 10.56.2.98 TCP 23 98455 3 Pass
10.122.23.1 10.56.2.5 TCP 1543 25 (mail) 4 Pass
Limitations of Packet
Filtering
Some rules could leave open doors to the
network
Difficult to determine examine exactly what the
rules permit
Proxy Applications
Applications on proxy gateways that act on
behalf of the user requesting service through the
firewall
Connection Process Using an
Application-level Gateway
Application-level Gateway
Application Authorization
Level Database
2
Proxy
2
1 4 3
Kernel Level
User Destination
Host
Connection Process
1 User first establishes a connection
to the proxy application on the
firewall
2 The proxy application gathers
information concerning the
connection and the requesting user
Connection Process (cont.)
3 This information is used to determine
whether the request should be permitted
- if approved, the proxy creates another
connection from the firewall to the
intended destination
Connection Process (cont.)
4 The proxy shuttles the user data
from one connection to the other
Proxy Challenges
Initial connection must go through the proxy
application on the firewall, not to the intended
destination
Proxy application must obtain the IP address of
the intended destination
Proxy Connections
Direct Connection
Modified Client
Invisible Proxy
Direct Connection
Connect directly to the firewall proxy using the
address of the firewall and the port number of
the proxy
Least preferred method
Requires two addresses for each connection:
Address of firewall
Address of the intended destination
Modified Client
Applications are executed client-side, at the
users computer
Effective and transparent
The need to have a modified client application
for each network service is a significant
drawback
Invisible Proxy
No need to modify client applications
Users dont have to direct their communication
to the firewall
Packets are automatically redirected to an
awaiting proxy as they enter the firewall
Proxy Limitations
New applications must be developed for each
supported service
User Authentication
Three traditional methods for verifying
someones identity:
Something known - a password
Something possessed - a key to a lock, or a
smartcard
Something embodied - fingerprint or retinal scan
Activity Logging
Information provided by log files:
Time and date of session start
Time and date of session end
Source host address
Destination host address
Activity Logging (cont.)
Information provided by log files (cont.):
Protocol
Destination Port
Action taken - accepted or denied
User name - if authentication used
Audit Information
Administrators may review the logs to look for
suspicious activities:
Repeated failed connection attempts
Flood of allowed connection attempts going to the
same host
Connections made at odd hours
Multiple failed authentication attempts
Unit II - Chapter 1
The Need for a Firewall
Firewall need (discussion)
Intranet
Internet Services
RAS
Financial connection (Reuters, Bloomberg, etc)
Extranet
etc.
Lab 1
What Firewall is Best?
Discussion Lab
Corporate Data Center
Company intranet Internet
Restricted Network
Place firewall(s) in this network.
Discussion lab
Internet connection
Email, ftp, dns, web public
Web surfing and ftp
Intranet
Oracle server
Discussion Lab
Corporate Data Center
Firewall Firewall
Company intranet Internet
Restricted Network
Possible solution.
Unit II - Chapter 2
Security Hazards
Security Hazards:
Objectives
Describe the threat of opens systems
networking
Identify simple denial of service attacks
Identify packet sniffing
Identify IP spoofing
Open Systems
Internetworking
A standard approach to computing and
networking that allows for:
Greater interoperability
Flexibility
Portability of software and system components
Isolated Islands of
Phone Connectivity
Phone Connectivity No
Longer Isolated
Open Systems Threat
Increased connectivity increases the threat of
attack
The more networks that are connected, the greater
chance of those networks being infiltrated
Internet Attacks Simplified
Denial-of-Service
Network Packet Sniffing
IP Spoof Attack
Denial of Service
Denial-of-Service Attack
A simple attack where the attacker repeatedly
sends their victim voluminous amounts of
electronic mail until the network can no longer
handle the volume - denying them of mail
service
Denial of Service Mail
Attack
Flood of E-mail
to Target
Target Mailbox Mail Server Attacker
Network Packet Sniffing
The attacker listens in to the data on your
network with a packet sniffer, capturing data and
displaying it in a readable manner
Source and destination users usually dont even
know that theyve been sniffed
Network Packet Sniffing
Attack
Network
Attacker
Original TCP Packet
Original TCP Packet
TCP Packet Copies
IP Spoof Attack
The attacker uses the unique IP address of an
unsuspecting target user, presumably for illicit
purposes
An IP spoof becomes a serious attack if the
external attacker claims to have an IP address
that is internal to the targeted network
IP Spoof Attack
Internal
10.12.1.1
Filter assumes packet is
from trusted source, and allows External
data into the network 10.35.25.6
Packet
Filter
Internal
10.12.1.5
Reports source address
to be 10.12.1.1
Unit III - Chapter 1
Firewall Features
Basic Access Control
Access Rules and Lists
Host Spoofing Controls
Access Rules and Lists
Host-Based
Describes the sets of services allowed for each host
or network
Service-Based
Identifies the sets of hosts or networks that may use
each service
Host Spoofing Controls
Reducing the threat of spoofing IP addresses:
Restriction of the source routing option allows a
host to control the route taken to return to the
source host address
Control by network interface also reduces the threat
Supported Services
Domain Name System (DNS)
DNS servers share information
An attacker could possible redefine the address of a
trusted host within a network to an address outside
the network
Supported Services (cont.)
Finger
Used to find out logins, user names, and information
concerning a users previous login
Supported Services (cont.)
File Transfer Protocol (FTP)
A separate network connection is usually made from
the destination host back to the original FTP
connection
Most FTP servers supports a PASV (passive mode)
capability allowing the connection to originate from
the client rather than the server
Supported Services (cont.)
Internet Control Messaging Protocol (ICMP)
Used to send error or test messages between
systems
PING uses ICMP to send echo requests to see if a
host is reachable
Supported Services (cont.)
Internet Relay Chat (IRC)
Using IRC, a user can contact an IRC server and join
an Internet conversation
Threats associated with IRC are of a social
engineering nature - an attacker may contact a user
through IRC and convince them to compromise their
network
Supported Services (cont.)
Network News Transfer Protocol (NNTP)
Allows users to access newsgroups to read
information or participate in discussions
Network File System (NFS)
Allows users to share file systems with other users
Little security and vulnerable to attacks
Supported Services (cont.)
Network Time Protocol (NTP)
A service used to synchronize clocks between
computers and networks
Supported Services (cont.)
rlogin
Developed at the University of California at Berkeley
Used for remote access between local systems, but
not recommended for use across the Internet
because of lack of proper authentication capability
Supported Services (cont.)
TELNET
Standard remote login protocol application
Provides a character-based connection between two
systems
User Authentication
Authentication Mechanisms
Remote/Central
Administration
Firewalls in multiple geographic locations should
be administered by a single group within the
company
With central administration the administrator
configures the firewalls from a central database
they all share
Actions Taken From Alarms
Recording the action in a log or alarm file
Sending e-mail to an administrator
Displaying a message on the firewall console
Sending an SNMP alarm to a network manager
system
Actions Taken From Alarms
(cont.)
Activating and sending a message to an
administrators pager
Running a specialized application or script file
from the firewall
Firewall Integrity
Dual-Host Firewalls
Splitting the functions of a firewall between two hosts
to force attackers to break into two systems for a
successful attack
Integrity Scanner
An application on the firewall that continually scans
the firewall for any unauthorized changes to files, file
size, or devices
Firewall Integrity (cont.)
Invisibility
A firewall that cant be seen is difficult to attack
Special Features
Address Mapping
Day and Time Restrictions
Load Control
Tunneling
Virtual Private Networks (VPN)
Hacker Traps
Address Mapping
Most organizations have invalid or illegal IP
addressing internally
Firewalls can map illegal addresses internally to
legal addresses as packets leave the network
Address Mapping
External Internal
192.168.1.2
192.168.1.1
Legal IP address Illegal IP address
204.32.38.1 192.168.1.2
LAN
192.168.1.4 192.168.1.3
Day and Time Restrictions
Security policies can be set to restrict certain
network access based on day and time
Day and Time
Restrictions
FTP allowed FTP disallowed
Load Control
Limits the number of simultaneous connections
permitted to a host
Helps protect against flooding attacks
Load Control
Limiting the number of simultaneous connections
Virtual Private Networks
(VPN)
Enables encryption all or selected
communication between two or more sites
Requires cooperating firewalls to encrypt and
decrypt packets as they are sent and received
Virtual Private Networks
(VPNs)
Company Internet Company
intranet 1 intranet 2
Firewall Firewall
Not encrypted Encrypted Not encrypted
PRIVATE PUBLIC PRIVATE
Hacker Traps
Sometimes referred to as lures and traps or
honey pots
Intruders think they have succeeded in breaking
into the network when in reality they have been
redirected to a safe place on the network
Unit III - Chapter 2
Security Policies
Security Policy
Philosophies
Flexibility
Service-access
Firewall Design
Information
Remote Access
Security Policy
Philosophies (cont.)
Flexibility
Ability to adapt or change the policy
Flexible due to the following considerations:
Internet changes
Internet risks
Security Policy
Philosophies (cont.)
Service Access
Internal user issues
Remote access policies
External connections
Security Policy
Philosophies (cont.)
Firewall Design
Permit any service unless it is expressly denied
Deny any service unless it is expressly permitted
Security Policy
Philosophies (cont.)
Information concerns
E-mail
Web browsing
Security Policy
Philosophies (cont.)
Remote Access
A users dial-out capability might become an intruder
dial-up threat
Outside users must be forced to pass through the
advanced authentication features of the firewall
